(N 

o 



a* 



Alternative schemes for measurement-device-independent 

quantum key distribution 

Xiongfeng Ma 1,2 ' 3 'Q and Mohsen Razavi 3, Q 

1 Center for Quantum Information, Institute for Interdisciplinary Information Sciences, 

Tsinghua University, Beijing, China 
2 Center for Quantum Information and Quantum Control, 
Department of Physics, University of Toronto, Toronto, Ontario, Canada 



3 School of Electronic and Electrical Engineering, 



University of Leeds, Leeds, United Kingdom 
Abstract 

Practical schemes for measurement-device-independent quantum key distribution using phase 
and path or time encoding are presented. In addition to immunity to existing loopholes in detection 
systems, our setup employs simple encoding and decoding modules without relying on polarization 



maintenance or optical switches. Moreover, by employing a modified sifting technique to handle 
the dead-time limitations in single-photon detectors, our scheme can be run with only two single- 
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■ photon detectors. With a phase-postselection technique, a decoy-state variant of our scheme is also 
OO , 

■<^j- , proposed, whose key generation rate scales linearly with the channel transmittance. 
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I. INTRODUCTION 



Quantum key distribution (QKD) enables two remote parties to securely exchange cryp 



tographic keys 



HQ. 



Despite the theoretically provable security of QKD protocols [3r|5|, 



achieving security with realistic devices is still a challenge [6r|l0|. In fact, before any se- 
curity proofs can be applied to practical scenarios, various device imperfections should be 
carefully examined. For example, the detector efficiency mismatch can be exploited by eaves- 
droppers to implement the efficiency mismatch attack 11] or the time-shift attack [I2I 
Lately, other imperfections, such as the detector's after-gate pulses and the dead time, have 
also been exploited in hacking strategies 14j-|l7j. Although, in each case, certain counter- 



measures have been proposed 



18 



191 ]. to fully remove such attacks one must deal with 



their fundamental root, i.e., the detection efficiency loophole. In this paper, we build on 
recent progress on measurement-device-independent QKD (MDI-QKD) 20|, |2l| to propose 
alternative practical schemes resilient to detection loopholes, thence shielding out all the 
aforementioned attacks in QKD systems. 

The security loopholes in QKD systems essentially stem from the existing issues in Bell's 
inequality tests. There are three major loopholes, corresponding to the three assumptions 
in Bell's inequality tests, 



1. locality loophole [221 ] . which is related to the assumption that two test parties are 
spacelike-separated; 



2. efficiency loophole 23[, which is related to the fair-sampling assumption 24]; and 



3. randomness (free-will) loophole, which is related to the assumption that measurement 
bases are chosen randomly. 



In the context of QKD, some of these loopholes have proved to be more harmful than the 
others. For instance, it is reasonable to assume that the information in the two legitimate 
parties of QKD, Alice and Bob, is protected from the eavesdropper, Eve. Thus, the local- 



ity loophole does not necessarily lead to 
quantum random number generators 25 



lacking strategies. With recent developments in 



26], the randomness loophole may not introduce 



security issues either. The efficiency loophole, however, opens up to many quantum attacks. 
In fact, the aforementioned attacks all fall into this category. 



One approach to overcome device imperfections is by using device-independent QKD 
(DIQKD) schemes 27H30||. The underlying assumptions of security in these schemes are 
relaxed to only a few, such as no, or little, direct leakage of key information out of QKD users. 
Unfortunately, DIQKD schemes impose severe constraints on the required specifications for 
physical devices in use. For example, the tolerable error rate is 7.1% and the minimum 
required transmittance is 92.4% [311 ] . which make its experimental demonstration extremely 
challenging. 

In order to relax the above constraints, several detection-device-independent QKD 
schemes have been proposed {32, 33]. The main additional assumption is that the source is 
trustful. In pra ctice, many QKD schemes use simple source setups, which can be monitored 



in real time [34 
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351 ] . The detection system, on the other hand, is more vulnerable to attacks 



41 7j]. In [32], for instance, a higher error rate of 11% and a lower transmittance of 65.9% 
are allowed. We emphasize that the scheme presented in [32] uses a partial self-testing tech- 
nique to overcome loopholes in detection. However, as pointed out in j^j], the time-shift 
attack puts an ultimate bound of 50% on the transmittance. This is due to the random bit 



assignment to no-click events in 
scheme 



32| . Recently, Lo, Curty, and Qi proposed an MDI-QKD 



that is able to essentially avoid random bit assignments, hence going beyond 



20] . By relying on entanglement swap ping techniques and 



the 50% efficiency limit 
reverse EPR schemes 13 



the MDI-QKD scheme 20] (see also 39]) can achieve similar 
performance to traditional QKD systems, while shielding out detection loopholes. 

Thus far, three schemes for MDI-QKD have been proposed, two of which rely on phase 
encoding [2l|, and the original one uses polarization encoding [2o| . The latter requires polar- 
ization maintenance over the quantum channel, which makes its implementation over optical 
fibers challenging. The phase-encoding scheme I in 21] essentially follows the coherent-state 



QKD scheme without phase randomization 



40] . and its key rate decays quadratically with 



the channel transmission efficiency 4l|. Scheme II in 2l] relies on the relative phase between 



two weak pulses. In order to perform entanglement swapping, in [2l] , this phase information 
is converted to polarization states before being measured by a set of four single-photon de- 
tectors. Both phase-encoding schemes require fast optical switches in the measurement unit. 
We remark that scheme I in 2jJ is more robust against some imperfections of the state prepa- 
ration, which may offer benefits in certain practical situations. Note that proof-of-principle 



field tests of the MDI-QKD scheme were presented recently 



42-4 



In this paper, we propose alternative phase-encoding schemes. Comparing to the one 



proposed in Ref. 



2l| . our schemes do not require optical switches in the setups. Moreover, 



the proposed schemes can be implemented with only two single-photon detectors, which 
makes them even more cost effective. By introducing a proper postselection technique, in 
the two-detector setup, we can minimize the effects of the dead time. Our schemes do 
not require polarization maintenance, and, if implemented with single-photon sources, they 
do not require a phase reference between Alice and Bob. The decoy-state versions of our 
setup are, however, sensitive to the choice of encoding bases, and in some cases require a 
mutual phase reference. By introducing a phase-postselection technique, we can, however, 
reduce the error rate in the decoy-state protocols. Note that the security of the proposed 
phase-postselection technique needs to be further investigated. 

The rest of this paper is organized as follows. In Sec. Dll we propose a path-phase- 
encoding MDI-QKD scheme with single-photon states. We simplify our setup in Sec. II III 
and generalize it to coherent-state sources in Sec. HVJ We conclude the paper in Sec. [V] 



II. SINGLE-PHOTON MDI-QKD 



In this section, we present an alternative MDI-QKD scheme using path and phase- 



encoding techniques 



epres 
4JJ47 



471] . A key component of our scheme is still a partial Bell-state 
measurement (BSM) module implemented by 50:50 beam splitters and single-photon de- 
tectors; see the Eve or Charlie's box in Fig. [TJ In this section, we assume that perfect 
single-photon (qubit) sources are used by Alice and Bob. We use the setup in Fig. [TJ to 
illustrate how our scheme works. In Sec. IHH we will present a more practical setup for 
implementation purposes. 

Our path-encoding MDI-QKD scheme works as follows. Alice and Bob, in Fig. [TJ each 
prepares a single-photon state and passes them through 50:50 beam splitters. The resulting 
two modes are referred to as reference and signal modes, denoted, respectively, by a r and a s 
on Alice's side, and b r and b s on Bob's side. In order to generate the four states of the BB84 
protocol, phase modulators, respectively, introduce relative phase shifts 9 a and 9b between 
the reference and signal modes of Alice and Bob to obtain the following state 

(|1>J0>. +^|0) a ll) a J«)(|l) 6 |0) 6a +e<*|0> 6 Ilk), (i) 
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FIG. 1. (Color online) A schematic diagram for the path-phase-encoding MDI-QKD scheme. Here, 
BS stands for 50:50 beam splitter and PM stands for phase modulator. Alice and Bob each encodes 
their qubits by introducing a relative phase shift between their reference and signal beams. The 
phase shifts are applied to the signal modes using PMs, chosen from the set {0, tt/2, it, 2>tt/2}. A 
partial BSM, possibly performed by an untrusted party, Eve or Charlie, on the two reference and 
the two signal modes would establish correlations between the raw key bits of Alice and Bob. 
Provided that they use the same phase basis, a joint click on detectors rg and sq implies identical 
bits for Alice and Bob, so does a joint click on r\ and s\. A joint click on rg and s\, or, r\ and sq 
would imply complement bits. 

where normalization factors are neglected for now. To follow the BB84 protocol, Alice and 
Bob randomly choose 9 a and 9^ from the two basis sets of {0, tt} and {it/2,3it/2}. Phase 
values and tt/2 represent bit 1 and the other two represent bit 0. When single-photon 
sources are used, the overall phase has no effect on the final result and will be neglected 
here. 

To better understand how the setup in Fig. [1] works, let us first neglect the channel loss 
and dark count effects, which will be addressed in Appendix |A] We also assume that the 
relative phase between the reference and signal modes is preserved; we will see that, in the 
next section, how this can practically be achieved. A successful partial BSM in Fig. [T]occurs 
when one, and only one, of tq and r±, and one, and only one, of So and Si click. All other 
detection events, such as the case when both tq and r\ click, are discarded. Conditioned on 
a successful BSM outcome, the relevant terms in the joint state of Alice and Bob are given 



The above state will go through two 50:50 beam splitters, which remove any which-way 



by 



|l)jO) a JO)Jl) 6s + e^-^\0)Jl)Jl) br \0) bs . 



(2) 
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information, in the BSM module resulting in 

|01 + 10) ror j01 - 10) sosi + e^-^IOl - 10) rori |01 + 10) SQSi 

= |0101 - 0110 + 1001 - 1010) ronsosi + e *C*--^)|0101 + 0110 - 1001 - lOlO)^^, 

where r , r 1; sq and s± represent the input modes to the corresponding detectors in Fig. [H 
and we have used the following transformation for the two beam splitters: 

|l)aJO) 6r ^|0) ro |l) ri + |l) ro |0) n , 

|o>Ji>^|o>Ji> ri -|i>Jo> ri , 

|l)aJO) fes ^|0) S() |l) Sl + |l) so |0) Sl , 

|o) Ji) 6s h+ |o) Ji) si - |i) jo) si . 

In the above equation, we assume that the photons arriving at the relay are indistinguish- 



able. This can be guaranteed by applying filters 48j before the 50:50 beam splitters in the 
measurement box. 

If 9 a — 9b = 0, then the state in Eq. ([3]) becomes 

10101-1010)^^; (5) 

that is, either detectors r and sq, and only these two, click or r% and S\ click. Otherwise, if 
@a ~ @b = i 71 ", then the state in Eq. (J3]) becomes 

10110-1001),,.., (6) 

which means that either detectors r and si click, or r% and So click. In all other cases, 
where 9 a — 6^ = ±7r/2, two random detectors out of four will click, and then Alice and 
Bob's qubits are independent of each other. Such events will be ruled out by a standard 
basis-sift procedure. Detection events on only reference (signal) detectors will be ruled out 
as well, justifying the choice of relevant terms in Eq. (J2J). In the end, Alice and Bob's bits, 
determined by relative phases 8 a and 9b, will be correlated or anticorrelated conditioned on 
the detection events in the relay. 

Similar to the single-photon case of the original MDI-QKD scheme 
formula for our MDI-QKD scheme follows Shor-Preskill's result j^, (| 

R>Y n [l-fH(e 11 )-H(e 11 )], (7) 



20|, the key rate 



6 



where Yn is the successful detection (trigger in the relay) rate provided that Alice and Bob 
send out single photons: en is the quantum bit error rate (QBER); / is the error correction 
inefficiency (see, e.g, 49]; normally / > 1 with the Shannon limit of / = 1); and H(x) is 
the binary entropy function, H(x) = — xlog 2 (x) — (1 — x) log 2 (l — x). In Appendix \K\ we 
derive the relevant terms in Eq. (J7J) when loss and other nonidealities are taken into account 
[see Eqs. (JM} and flATT]) ]. 



Our single-photon MDI-QKD scheme offers certain advantages over similar schemes in 



201 ] and 2l| . A key difference of our scheme with the original MDI-QKD scheme in 20| lies 



on their encoding procedures. In the scheme of Fig. [H the qubit information is encoded in 
the relative phases of two orthogonal optical modes. The original scheme, on the other hand, 
relies on polarization encoding, which requires sharing a polarization reference between all 



three parties and po 
QKD scheme II in 



arization maintenance along the channel. As compared to the MDI- 
21], if used with single photons, both schemes use similar phase encoding, 
and are resilient to overall phase errors. In our case, the detection setup is simpler: it does 
not rely on optical switches and, as we will show in the next section, it can operate by using 
only two detectors. Note that, for the partial BSM part, all schemes require indistinguishable 
photons, hence filtering before the BSM modules is necessary. 



The scheme in Fig. [T] relies on single-photon states for its proper operation. In practice, 
on-demand single-photon sources can be implemented using parametric down-conversion 



processes 



501 ] . or by relying on quasiatomic systems such as quantum dots 5l|. In these 



scenarios, one must consider the effect of multiple photons on system performance, which will 
be addressed in a separate publication. With recent advancements in compact cost-effective 
single-photon sources, the reliance on single-photon states in our scheme is not necessarily 



a setback, especial 
those proposed in 



y when considering the simplicity of the BSM module as compared to 



20 



211 ] . Nevertheless, in Sec. HVl we present the decoy-state version of 



our protocol, which does not rely on single-photon sources. 



The setup in Fig. [TJ requires two optical channels for each user, which seems redundant 
and requires relative phase maintenance between the two channels. In the following section, 
we show that, by using a simple time-multiplexing trick, one can resolve both issues. 



III. MDI-QKD WITH TIME MULTIPLEXING 



Instead of path encoding, Alice and Bob can use time multiplexing to separate their 
reference and signal modes. That can be achieved by using Mach-Zehnder interferometers 
at the transmitter, as shown in Fig. [2J That would result in both reference and signal 
pulses traveling along the same physical channel. Moreover, if the time delay between the 
two modes is sufficiently short, we can reliably assume that the relative phase between the 
reference and signal modes is well preserved along the channel, as required in Fig. [TJ The 
BSM module in Fig. [2] is also simpler than that of Fig. [H as we are only using two, rather 
han four, single-photon detectors. It is also simpler than the proposed BSM modules in 



20 



21], as it does not require optical switches or phase-to-polarization converters. Similar 



to any other schemes, time synchronization is required to ensure that the corresponding 
reference and signal modes will arrive at the right time and properly interfere with each 
other. 




FIG. 2. (Color online) A schematic diagram of the time-multiplexed MDI-QKD protocol. Alice 
and Bob each encodes their qubits onto relative phases of two optical modes separated in time, a r , 
a s , b r and b s , respectively. The partial BSM, using a 50:50 BS, is performed in the relay owned by 
a possibly untrusted party. 



The main problem that must be addressed in this time-multiplexed scheme is the dead 
time of single-photon detectors. That is, after detection, a detector will be nonresponsive 
(dead) for a period of time until it resets. The dead time of a detector is caused by the 
after-pulse effect in avalanche photodiode single-photon detectors. In the time-multiplexed 
scheme, the detectors are required to detect photons in two consecutive pulses, whose time 
difference could be short. The dead time of detectors then ultimately limits the repetition 
rate of the proposed scheme. Here, we propose proper postselection methods to address the 
dead-time problem. 

For the postselection of events, at the BSM module of Fig. [2J we consider two scenarios. 
In the first scenario, we assume that the dead time of single-photon detectors is shorter 

8 



than the delay in Mach-Zehnder interferometers. In this case, we can use exactly the same 
postselection technique as described in Sec. [TTJ The only difference would be that for the 
time slot corresponding to signal pulses, detectors r and r x in Fig. [2] resemble detectors s 
and Si in Fig. [TJ With recent advances in single-photon detectors with ultrashort dead times 



52 



53), one can use a repetition rate as high as 500 MHz with our scheme. In order to go 



to higher repetition rates, one must use a delay possibly shorter than the detector's dead 
times. From the discussion of Eq. (jSJ) and (JSJ), we notice that only when Alice and Bob's 
results are correlated (they have used the same phase), is the dead-time issue problematic. 
In order to resolve this issue, Alice and Bob can further sift out those detection events 
resulting from the terms in Eq. §5§. That is, by accepting a factor of 1/2 loss in the final 
key rate, we will only keep measurement results in which both r and r\ click, each at 
a different time slot corresponding to the arrival of the reference or signal beams. With 
the above modified postselection technique, the setup in Fig. [2] provides comparable secret 
key generation rates to other single-photon MDI-QKD schemes, while offering a simple and 
cost-effective structure. 



The setup in Fig. |2] can be easily modified to implement encoding in all three Pauli 
bases. If we represent the standard basis vectors, i.e., eigenvectors of the Z operator, by a 
single-photon state in the reference mode and a single-photon state in the signal mode, the 
encodings implemented by the setup of Fig. [2] are that of A and Y bases. If one replaces the 
first beam splitter in the encoder with a polarizing beam splitter, and uses horizontally or 
vertically polarized light at the source [541], we can use the same setup for Z-basis encoding 
as well. In the case of single-photon sources, which of two bases to choose for the QKD 
protocol is arbitrary. Once we consider the decoy-state version of our protocol, however, the 
choice of bases is more crucial. In fact, it turns out that A and Y bases are prone to a larger 



value of QBER than the Z basis. That is why, in the experimental setup of |42|, 144 1. Z- 
and A-basis encoding is used. A brief analysis of the decoy-state version of the MDI-QKD 
protocol with Z- and A-basis encoding is given in [20J , which we will rederive within our own 
setup in Appendix [B] In the next section, however, we will consider the more challenging 
A- and F-basis encoding for the decoy-state protocol and propose postselection techniques 
to reduce the QBER in such a scenario. 



IV. DECOY-STATE MDI-QKD 



In this section, the decoy-state version of our scheme is presented. A weak laser pulse is 
perhaps the easiest way to approximate a single-photon state. Due to the multiple-photon 
component in a laser pulse, in the context of QKD, coherent-state sources are considered to 



be basis dependent |55j. For a basis-dependent source, one can apply decoy-state technique 



to monitor the channel transmittance of the single-photon component in the source 



40 



56 



In the security proof of the decoy-state scheme, the overall phase of the coherent-state 
source is assumed to be randomized 



40 



59( . The main problem with using phase-randomized 
coherent states, in the setup of Fig. [TJ is that the probability of a single photon coming out 
of Alice's source and a single photon from Bob's source is on the same order as the case of 
having two photons at Alice's or Bob's, and no photon out of the other source. The former 
is what we need to generate a secret key bit, whereas the latter could result in random 
clicks. In fact, the QBER in the scheme of Fig. [1] could be over 20% if we use a standard 
decoy-state protocol. In order to resolve this issue, in this section, we assume that Alice and 
Bob have a common overall phase reference. We then use an improved phase-postselection 
technique to enhance the efficiency of error correction. We remark that a full security proof 
of this technique is yet to be addressed. 



A. Key rate 



The security analysis for our scheme with decoy states follows from that of [20|] and 21], 



which rely on the photon-number channel model used in [40]. The key rate for the original 



decoy-state QKD is given by [40|, [60 ] 



R > qi-QJHiE,) +Q 1 [1- H( ei )] + Qo}, (8) 

where q is the basis sift factor; the subscript \x denotes the average number of photons per 
pulse; and are, respectively, the overall gain and QBER; Q 1 and e% are, respectively, 
the gain and the error rate of the single-photon components; and Qo is the gain of the 
vacuum state (from background). 

There are certain details to be considered before applying Eq. ([8]) to our case. The basis 
sift factor q is equal to 1/2 in the original BB84 protocol due to the fact that half of the time 

10 



the bases chosen by Alice and Bob disagree. In the efficient BB84 protocol 61], however, 
the factor q can approach 1 in the infinite-size key limit. In our MDI-QKD scheme, there is 
an extra factor of 1/2 due to the partial BSM described in Sec. HI1 If one uses the correlation 
sift technique to handle the dead time problem as discussed in Sec. IIII[ another factor of 1/2 
must also be accounted for. In our key-rate analysis, described in Appendix [Bj we merge 
this factor, q, into other gain factors to obtain 

R>Q 11 [1-H(e 11 )] + Q' 0flb -I ec , 

(9) 

lec — Q /ta/tfc/ 'H- (-^AtaMb) ' 

where I ec is the cost of error correction; Q^ afJlb {E^ a ^ b ) is the overall gain (QBER) when 
Alice and Bob, respectively, use an average photon number of /i a and fib', Qn (en) is the 
gain (QBER) when both sources generate single-photon states; and Q' 0flb = exp(—fi a )Q 0flb 
is the probability that there is no photon from Alice's side and a successful BSM occurs. 
Appendix [B] provides detailed definitions for the above parameters. 

Here, we assume that Alice and Bob use forward classical communication (Alice to Bob) 
for error correction and privacy amplification, which leads to the Q'o^ b term in the key rate 
formula in Eq. (Q. The security argument behind it is that when Alice sends out vacuum 



states, Eve gains nothing about Alice's qubits by measuring the state in the channel [60|, 162 ]. 
Of course, one can assume that Alice and Bob perform reverse reconciliation, in which case 
(Jq must be replaced with Q' = exp(— /i b )Q /Ja0 . We emphasize that, because of relying 
on two photons for a successful BSM, Q' ^ b is on the same order of Q^ a ^ b for coherent- 
state sources. Thus, its contribution is significant. On the contrary, for the key rate of a 
regular decoy-state QKD given by Eq. ([8]), the contribution from the vacuum state, Qo, is 
insignificant due to the fact that normally the background count rate is much lower than 

Note that, in MDI-QKD schemes,postprocessing can be performed separately on bit 
strings obtained from different bases 63J, or from different detection events (correlated and 
anticorrelated). In practice, this extra information may be useful for error correction 32]. 



B. MDI-QKD with phase postselection 



As mentioned before, the intrinsic QBER in our decoy-state scheme can be very high if 
one uses a fully phase-randomized coherent source. Note that randomization of the overall 

11 



phase over [0, 2ir) can be regarded as randomization over one of the following N regions: 

[™, i!!^) u { ^±pl, < m + ^ ) | m = 0, !, 2, iV - l} . (10) 

The choice of the region and the overall phase therein are random at the source. In the con- 
ventional decoy-state protocol, no information about the overall phase is exchanged between 
two users. In our scheme, before error correction, Alice and Bob would reveal which region 
they had used. They would only keep raw key bits for which they both have used the same 
phase region. This extra information would reduce the cost of error correction, because the 
QBER is different for the raw key from different regions. In fact, in Fig. El we can see that 
by using N = 4 and N = 8, corresponding to, respectively, two and three bits of classical 
information, the QBER has been reduced to below 5% and 1.3%. In Fig.[3l we have assumed 
that r] a fi a = r] b fi b , where r\ a and r] b are, respectively, the total transmission efficiency for Alice 
and Bob's paths. In Appendix [Bj we show that the QBER E^^ is minimized under this 
condition. Note that Alice and Bob do not need to control the phases of coherent states 
precisely, which is practically challenging. Instead, as long as they know the phase partition 
in Eq. ({TO]) with a high probability, the phase postselection method proposed here can be 
implemented. We leave the case where Alice and Bob do not exactly know the phase values 
for future study. 

Conditioned on the classical bits Alice sends to Bob, the cost of error correction in Eq. (J9j) 
is given by 

i ec = Y,Q rn f H ( Em ), (ii) 

m 

where m is the partition index in Eq. ( flOl) . and Q m and E m are the corresponding conditional 
gain and QBER [see Eqs. flBT9|) and (|B20|l ]. 



Our numerical calculations show that the key rate given by Eqs. (j9J) and ( jlTl) is not 
positive for the parameter set listed in Table [H If, however, one assumes the gain and error 
rates of single-photon states are evenly distributed over the partitions of Eq. (Tl0]) . the key 
rate formula, Eq. ([9]), becomes 

R > jjQn[l ~ H(e n )} - Q m fH(E m )\ m=0 , (12) 

where we take the lower bound of Q'q^ > 0. Here, we only keep the term corresponding to 
m = in Eq. (TlT]) . in which case E m is minimized. 

12 
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FIG. 3. (Color online) QBER for the MDI-QKD scheme in Fig. [T] with coherent-state sources, 
conditioned on partial knowledge of the overall phase. The overall QBER, calculated by Eq. (|B15p . 
represents the case where no phase information is shared. Curves labeled "W/ 2(3)-bit comm" 
represent cases where Alice and Bob postselect states coming from the same phase region, out 
of N = 4(8) phase bands in Eq. (|10p . The conditional QBER is calculated numerically using 
Eq. (1B201) . No background noise or misalignment is assumed. 

C. Key-rate comparison 



In this section, we numerically compare the secret key generation rate for the MDI-QKD 



schemes proposed here us,„g single-photon and decoy-coherent states with that of 20]. For 
fair comparison, we use the same parameter values used in [20J for our numerical evaluation, 
which follow the experiment reported in 64] (see also [gsJ] ) . The numerical parameters used 



are listed in Table [D We have used Eq. (fT2|) and formulas in Appendixes |A] and [B] to evaluate 
the key rate of our decoy-state scheme. 



Quantum efficiency 



Pd 



f 



e-d 



14. 



3.0 x 10" 6 1.16 11 



TABLE I. List of experimental parameters used in numerical results: p<i is the background count 
rate per detector; / is the error correction inefficiency; and is the misalignment error between 
Alice and Bob, which characterizes the stability of the relative phases at the encoders and through 
the channel. Note that two detectors are used in the original experiment [64|, thus, p,i should be 
roughly half of the total background count rate. 
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Figure H] shows the secret key generation rate for the three schemes mentioned above. 



The middle curve corresponds to that of the original MDI-QKD scheme |20] , obtained from 
Eq. (1B27|) . It can be seen that while our single-photon scheme can outperform the original 
MDI-QKD scheme, our decoy-state protocol falls short of achieving the same performance. 
Nevertheless, both our schemes offer simpler BSM modules than what proposed in [20| and 



21] . One of the reasons why the key rate of our scheme is lower than the original scheme is 



the additional phase postselection factor of iV = 8. 
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FIG. 4. (Color online) Key rate comparison for single-photon and decoy-state MDI-QKD schemes. 
The setup parameters are listed in Table HI The solid line indicates the key rate for the X-Y-basis- 
encoding scheme with decoy states plus three-bit communication for overall phase postselection, 
shown in Eq. (|12p . The dashed line shows the performance of the original MDI-QKD with X-Z- 
basis encoding. The related formulas for simulation can be found in Appendixes lAl and IB1 The //'s 
are optimized for the two decoy-state curves. 



The key rate in our scheme (and the original scheme [2Cj) scales better with distance than 



that of scheme I in 



21] . The latter yields a key rate scaling quadratically with the channel 



transmittance, whereas in our scheme, it scales linearly. This is because the optimal of 



21], whereas the 



scheme I is on the same order of the transmission efficiency as shown in 
optimal fi in our scheme is on the order of 1, as shown in Fig. 

From Fig. \5\ one can see that the optimal fi in our scheme is smaller than the one given by 
the original MDI-QKD. This is because in our scheme, multiphoton states would introduce 
false triggers in the BSM relay, which causes an error rate of 1/2. In order to reduce such an 
effect, a smaller \i should be used. This is another reason why the key rate of our decoy-state 
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Decoy: 3-bit 

Decoy: original 



10 20 30 40 50 

Channel transmission loss (dB) 

FIG. 5. (Color online) Optimal average photon number of coherent state for the X-y-basis- 
encoding scheme (solid line) and the original MDI-QKD scheme (dashed line, X-Z encoding) with 
decoy states. The setup parameters are listed in Table Hand the related formulas can be found in 
Appendix [Bj 

scheme is lower than the original one, as shown in Fig. HI We remark that the key rate is 
quite stable with certain changes of //, except for the regime where the channel loss is close 
to the maximal tolerable one. 



V. CONCLUDING REMARKS 

Measurement-device-independent schemes have been proposed to close the detection loop- 
holes in QKD systems. In this paper, we presented phase-encoding MDI-QKD setups that 



could offer certain practical advantages over previously proposed schemes in 2fj,|2l|. If im- 
plemented with single-photon states, our scheme enjoys a simple detection setup, consisting 
of only two single-photon detectors and a 50:50 beam splitter, with little or no compromise 
on the performance. Polarization or overall phase maintenance through quantum channels 
is not required in our schemes, either. This is an advantage over the polarization scheme in 
20 1 or the phase-encoding schemes in {21]. There are different decoy-state versions one can 



implement using our setup. The original MDI-QKD is effectively using an X-Z-basis en- 
coding, with a lower QBER for the Z basis. Here we showed that, by a proper overall phase 
selection scheme, we could achieve positive secret key rates even if we used X and Y bases 
for encoding over a moderately long range of distances. We remark that the security of the 

15 



phase postselection technique described in Appendix IB 21 needs to be further investigated. 



Similar questions were raised for DIQKD schemes 



32]- 



For a full key rate analysis, finite-key effects and statistical fluctuations must also be 
considered. That would include fluctuation analysis for decoy states [57] as well as phase 



error estimations 



63 



66]. We remark that the statistical fluctuation analysis for the MDI- 



QKD with decoy states has been recently presented [54j. Other finite- key effects, such as 
authentication, are expected to be negligible compared to the above two effects in a large 



parameter set 



63]. 



In the current MDI-QKD realizations 



20 



21) , including the one we propose here, we 



assume Alice and Bob use the same source settings. It is interesting to study the case where 
two source settings are different. For instance, one of the parties uses coherent states with 
the decoy-state protocol and the other one uses single-photon states. 

We finally remark that our proposed scheme can be easily adapted to quantum network 
settings 63, |68[. For a single- hop network, the switching center is a collection of several 



BSM modules along with switching and controlling devices. For 
connect two switching centers with quantum repeaters 



46 



47j, 



69 



onger distances, one can 



72J and effectively enable 



any two users to exchange secret keys. One of the key advantages of such a setup is the 
simplicity and the low cost of local users' equipment (the optical source), while the more 
expensive part, i.e., detectors, are shared among all users. 
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Appendix A: MDI-QKD with single-photon states 



In this appendix, we will consider channel losses, background counts, and misalignment 
errors for the scheme introduced in Sec. [Til 

The initial joint state of Alice and Bob is given by Eq. ([1]). After passing through lossy 
channels, modeled by beam splitters with transmissivities rj a and r)b, and considering the 
normalization factors, the state in Eq. ([T]) becomes a mixed state as follows: 

^|^i)(^ii| + ?7a(1 ~ 776) ^io)^io| + (1 ~g a) ^ |^i)<^bi|+(l-ifa)(l-^)l^o>(^o|, (Al) 
where 

|V>u) = |1010) + e iflo |0110) + e^|1001) + e i(9tt+ft) |0101), 
|Vio> = 11000) + e^|0100), 

(A2) 

|Voi) = |0010> + e ie "|0001), 

|Voo) = loooo). 

Here, as a shorthand notation, in the above equation \abcd) represents the joint number 
state \abcd) arasbrbs . 

The state in Eq. (]Alj) will then pass through beam splitters in the relay, as described in 
Eq. (JH). The state \4>n) is transformed to 

[|1010> + e i0a |OHO) + e*»|1001) + e i(ea+e&) |0101)] 

^ _L| 02 - 20)|00) + ie*-|01 - 10)|01 + 10) (A3) 

+ -e^ b |01 + 10)|01 - 10) + ^e i(ea+9b) |00)|02 - 20), 
2 \/2 

where the optical modes a r , a s , b r , and b s are mapped to r , r±, so, and si. Here, we used 
the following transformations corresponding to a 50:50 beam splitter 



|o)Jo) 6r ^|o)jo) ri , 

- I2L \0)_ 1/a/2, 

(A4) 



|l)ajl) fer ^[|0) ro |2) ri -|2) ro |0) ri 



|o>Jo) 6s ^|o)jo) si , 

|l)ajl) 6s ^[|0) so |2) si -|2) so |0) si 

where the arrived photons are assumed to be indistinguishable, say, by passing through 
proper filters, such as polarization and frequency filters, before the partial BSM. 
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Similarly, other states in Eq. ( 1A2|) are transformed to 



|1000) + e i0a |OlOO) ^ [|01 + 10)|00) + e <0 °|00)|01 + lO)]/^, 
|0010) + e iflfc |0001) i — ^ [|01 - 10)|00) + e iea |00)|01 - 10)]/^, 
|0000) i — ^ |0000). 



(A5) 



Define a successful partial BSM event to be the case when exactly one of the two detectors 
in each mode of the relay (that is, r and s , r and s\, r\ and s , or r 1 and Si) clicks, as 
shown in Fig. [1] The yield, Yn, is defined as the probability to have a successful measurement 
event, given that both Alice and Bob send out single-photon states and choose the same 
basis (that is, 9 a — 9 b = 0,ir). 

When Alice and Bob's bits are correlated (9 a — 6 b = 0), Eq. (1A3j) becomes 

[|1010> + e i0Q |OHO> + e^|1001) + e l(ea+e6) |0101)] 

1 1 (A6) 

^ — 102 - 20)|00) + e lflo |0101 - 1010) + -^e 2 ^ a |00)|02 - 20), 
V 2 V 2 

where the second term on the right hand side is the postselected term mentioned in Eq. (jSJ). 

With Eqs. (1A1I) . (1A2j) . ( 1A5|) . and (1A6j) . we can calculate the probability for a single click 
in each mode when 9 a — 9 b = 0, 



VaVb 



+ 



0*11 



rosi 



3*11 



riso 



:i-w) s 



4 V 2 4 

7?a + ??6 37? a 7; 6 



Pd+ (1 - ^a)(l - Vb)P d 



Pd+(l~ Va)(l ~Vb)P d 



(A7) 



where pd is the background rate for one detector (pd & Y /2). Due to the symmetry, the 
probabilities for the case when 9 a — 9 b = it are similar: 



n 1 11 — 0-Tll ; 



7T-T 11 

7T J H 7T 11 — CM 11 



(A8) 



Thus the yield Yn, defined as the total probability to have a successful measurement event 
when Alice and Bob use the same basis, is given by the summation of the terms in Eq. (IA7j) 
[or Eq. (TA~8~]) ] as follows: 



11 — CM n + CM n + CM 11 + CM n 



VaVb 



+ (2rj a + 2rj b - 3rj a rj b )p d + 4(1 - T] a )(l - r] b )p 2 d 



(A9) 



18 



When p d = 0, Y"n = r) a r] b /2, which is reasonable because the probability of the two optical 
modes each containing exactly one photon is 1/2. 

An error may occur when 9 a — 9 b = but an anticorrelated detection signal comes out; 
that is, detectors tq and si, or r\ and sq click. Thus, the error rate due to background noise 
is given by 



e n r n _ 0^ 11 + CM n 



(1- 

eo(l 



p d + 2(l-r ]a )(l-r ]b )p 2 d 



(AlO) 



[(2r] a + 2r] b - 3r] a r] b )p d + 4(1 - rj a )(l - rj b )p 2 d ] 



where eo = 1/2 is the error rate of a random (background) noise. Now considering possible 
phase errors, i.e., the deviation of Aq = 9 a — 9 b from its nominal value, the total error rate 
is given by 



VaVb 



e u Y n = (1 - 

= e Y n - (eo - e d )(l-p d ) 



ed-^- + e (2?7a + 2r] b - 3r) a r) b )p d + 4e (l - rj a )(l - rj b )p d 



2 VaVb 



(All) 



where is approximately the variance of Ag, accounting for channel relative-phase distor- 
tions (misalignment). 



Appendix B: MDI-QKD with Decoy States 



In this Appendix, we calculate the key parameters in Eq. ((9]). As pointed out in 20], with 
an infinite number of decoy states, theses parameters can be accurately estimated. One of 
the key assumptions in decoy-state analysis is the phase randomization at the source jo7 ]. 



According to the photon channel model 40], with phase randomization, a coherent state 



can be regarded as a mixture of Fock states. In fact, any state can be treated as a mixture 
of Fock states when the phase of the Fock state component is randomized. In this appendix, 
we first consider the case when the phase is randomized over [0, 27r), and then consider our 
phase postselection technique. For simplicity, we only consider the limit of the efficient BB84 
scheme, where the basis-sift factor is approaching 1 [61]. That is, the difference between 
relative phases set by Alice and Bob in Fig. [1] is either or 7r almost surely. 
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1. Coherent states with full phase randomization 



Now, let us consider the case where phase-randomized coherent states are used [73 ]. 
According to the Poisson distribution of photon numbers in a coherent state, the gain of 
single-photon states Qn defined as the probability that both Alice and Bob send out single- 
photon states with the same basis and obtain a successful partial BSM is given by 



(Bl) 



where the yield Y n is given by Eq. (1A9j) . 

Next, we evaluate the overall gain and QBER. Alice and Bob prepare coherent states 
with intensities \i a and fib, respectively, and randomize the phases 



(B2) 



where cj) a and 0& are the overall randomized phases. Then, the photon sources are split into 
two orthogonal optical modes, labeled by r and s, by 50:50 beam splitters, as described in 
Sec. Ill 



i<f> a 



V 2 / or I V 2 / a 3 \ V 2 / b r \ V 2 / 1 



(B3) 



where 9 a and 6^ are the relative phases Alice and Bob want to encode, as shown in Fig. [TJ 
Transmitting through lossy channels, modeled by beam splitters, the joint state arrived at 
the relay can be expressed by 



%4>a ^JUEMK^j \pi(6a+4>a) , / VaVa \ \ r i<t>a _ / VbPb \ \ p i(8 b +4>b) , /JELL 



(B4) 



After passing through the beam splitters in the relay, the state is transformed into, according 
to Eq. PJ, four detection modes, r , r 1; s and Si, 



J<j>a VVa^a _|_ ^ VVbVb \ 

2 I r 



i(f> a VnalJ-a _ ic/) b Wb^b 

e 2 2 



J(6 a +<Pa) V!EEi _L r i(Bh+<t>h) V^fe 



joM^q-ryq ; v - j pi 



J(9a+fi»)VW« _ r i(9 h +d> h ) Vrjb&b 
c 2 2 



(B5) 
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Therefore, the detection probabilities for the four detectors are given by 

2 N 



D ro = 1 - (1 -p d ) exp 
D ri = l- (1 -p d )exp 
D So = 1 - (1 -p d )exp 
D Sl = 1 - (1 -p d )exp I - 



2 2 



2 2 



J(8 a +<l>a) yftEEl _L_ J{e b + <t>b) ^^ b ^ b 

2 + 2 



(B6) 



2 2 



For simplicity, we use the following notations: 

A^ = O - a , 

y = {l-p d )e-M 



(B7) 



Here, // denotes the average number of photons reaching the relay, and A^ denotes the dif- 
ference between the random overall phases set by Alice and Bob, which should be integrated 
over [0, 27r). Then, Eq. (IB6|) can be simplified to 





= 1 


_ ye - X cosA^ 


D ri 


= 1 


xcos A^ 


D S0 


= 1 


-xcos(A^+e a - 


D n 


= 1 


xcos(A^+e a -9 b 



(B8) 



The gain is defined as the probability that Alice and Bob choose the same basis 

and obtain a successful measurement, and is given by 

QuaM = [A*(l - D ri ) + (1 - D rQ )D ri ][D SQ (l - D S1 ) + (1 - D S0 )D S1 }. (B9) 



Strictly speaking, Eq. flB9j) should be averaged over random phases a and 06, and different 
values for # a and We delay this averaging until the last stage. By substituting Eq. (1B8I) 
into Eq. (1B9j) . we have 



Qu a u b = y 2 (e-* co8A * + e xcosA <t 



2y) 2 , 



(BIO) 
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where we use the fact that \9 a — 9b\ = 0, tc when Alice and Bob choose the same basis. For 
a small // (thus, ^r] a fi a r]bfib < // /2 is also small) and pd = 0, the gain, Eq. (IBlOj) . will be 
approximated by 



-+ (jj ■ ( B11 ) 

Note that Eq. (1B1 1|) is independent of A^, which can be understood as follows. In the weak 
coherent-state limit (i] a fi a ~ f]bfib "C 1), there are two dominant terms in the relay: single- 
photon states on both sides versus a vacuum state on one arm and a two-photon state on 
the other. The vacuum state is not affected by the phase shift, and then the phase of the 
two-photon state will behave like an overall phase, which does not affect the measurement 
result. Also, as shown in Sec. Ull the randomized phase does not affect the partial BSM of 
single-photon states. Thus, Eq. fIBllj) is independent of A^. 
Now, we take the integral of A^ for Eq. (IBlOj) . 

Q^ b = 2y 2 [l + 2y 2 - Ayl (x) + I (2x)], (B12) 

where Iq(x) is the modified Bessel function of the first kind. For small values of x, one can 
take the first-order approximation to Io(x) «1 + x 2 /A to verify that Eq. (IF312[) approaches 
Eq. (1B11I) . when pd = and /jf is small. Note that in this weak coherent-state limit, 
the overall gain Q^ a ^ b cannot be approximated by the gain of single-photon states, Qn 
in Eq. fIBll) . because two-photon states cannot be neglected in this case. This is different 



2 



from regular decoy-state QKD [571 ]. where a coherent state can be approximated as a single- 
photon state when the intensity is low enough. We remark that this property will make the 
statistical fluctuation analysis more complicated for MDI-QKD. 
Using Eq. (IB12p . we calculate Q' Q ^ b as follows 

Q' , b = e-" a Qo, b 



= 4(1 -p d fe-^ bl2 '^[l - (1 -p d )e-^ b } 2 . 



(B13) 



The term Q' appears as an additive term in the key rate formula of Eq. (jH]) because we 



assume a forward classical communication (Alice to Bob) is used for postprocessing 60l. |62|. 
The intuition behind it is that, when Alice sends out a vacuum state as an information 
carrier, no one (including Eve) can get any information about the final key (Alice's bit) by 
measuring the signals in the channel. 
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The overall QBER is defined as the error rate in the sifted data. Similar to the 

derivation of Eq. flAllj) . due to symmetry, we only need to consider the case of 9 a — 9b = 0. 
Without loss of generality, we assume 9 a = 9b = 0, which leads to D ro = D so and D ri = 
D Sl in Eq. (1B6[) . In this case, an error happens when the relay announces anticorrelated 
bits corresponding to clicks on Ti-Sq and r -Si detectors. The intrinsic error rate, due to 
background noise and multiphoton states, is then given by 

tf^Qw = 2A*(i - Ai)(i - D S0 )D S1 

(B14) 

= 2y 2 (y - e xcosA *)(y - e - xcosA *). 

It can be verified that Eq. (IB14I) is a decreasing function of x. The minimum of E' 
is then obtained when r\ a [i a = r\b\ib- Averaging over A^ in Eq. (IBlOj) . we have 



^O^ = 2y 2 [l + y a -2y/ (x)], (B15) 

where x and y are defined in Eq. (IB7I) . Finally, considering relative-phase distortion errors, 
in a similar way to Eq. (lAllj) . we obtain 

E^ b Q^ b = e Q, a , b - 2(e - e d )y 2 [I (2x) - 1). (B16) 



2. Phase randomization with postselection 

If Alice and Bob randomly set the overall phases of their coherent sources, a large intrinsic 
QBER is accrued (see Fig. [3]). From Eq. (1B14j) . the intrinsic QBER is if = 0, fi a r] a = 
[ibVb, an d Pd — 0. The condition A^ = implies that Alice and Bob must use the same 
overall phase value, which jeopardizes the security assumption that requires random-phase 
values. In order to reduce the cost of error correction, they can, however, inform each other, 
at the sifting stage, the phase region they used in Eq. (TTOT) . We remark that this improved 
data postprocessing is originated from the one proposed in {32]. 

Let us take a look at a simple example where Alice sends Bob two-bit classical information 
for phase postselecting. Then, according to Eq. (jTUJ), they can divide the phase in [0,27r) 
into four partitions: 

■ rnvr (m+j> (m + 4)?r (m + 5)tt J 
— , 4 )U[ , ^ ) I m = 0,1, 2, 3 1 . (B17) 
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The two classical bits for each pulse are used to identify which partition they use for their 
random phases. Then, the cost of error correction is given by Eq. (Q , 

3 



Q m fH(E r 



(B18) 



m=0 



where, due to the symmetry, we can assume Alice picks up m from {0, 1, 2, 3} randomly and 
Bob always uses m — 0. 

The gain Q^afj-t ^ n -^I- fl-BlOj) should be averaged over A^ from mir/N to {m + 1)tc/N, 
yielding 



Q m = - 



jy rir/N y r{m+l)irjN 



71 



2l —x cos A ri 



^ Jrrnr/N 



\y ye. 



+ e 



x cos A 



(B19) 



Similarly, for the QBER, E' h Q one should take the integral of Eq. (IB14p to obtain 



E' m Q r 



jy p-k/N ^ Mm+l)-K/N 



b - i d( p a 2y\y-e xcos ^)(y-e 

71 Jmw/N 



-x cos A„ 



)■ 



(B20) 



The intrinsic QBERs for m = with two cases, k = 2 and = 3, are shown in Fig. EJ where 
= log 2 N. 

Let us consider the case when rj a fi a = rjbfii,, which minimizes the intrinsic QBER of 
Eq. (1B14p . hence /jf = 2r] a {i a , x = r\ a [i a = [i'/2, and y = (1 — pd)e~ x . Assuming p d < // <C 1, 
and using the first-order approximation to Eq. fIBlOl) . we obtain 

4 



Q 



(B21) 



which is independent of m, and, for Eq. (IB14I) . 



E' m Q r 



N 



y\i-y) 2 - 



2x 2 y 3 N r ,N 



7T" 



(m+l)ir/N 



mn/N 



b a cos 2 + 0(/i 



/3\ 



^ 2 (i-^-^-^ m ,» + ooA 



(B22) 



where 



.4 



COS 



2(-l + m)vr 



+ 2 cos 



2m7r 

1\T 



— cos 



2(1 +m)vr 
N 



(B23) 



and we use the fact that 1 — y — O (//'). From the numerical evaluation, we notice that 
Eq. (IB22j) gives a slightly higher value for QBER than the integral in Eq. (1B20|) . Finally, 
similar to Eq. (1B16I) . the overall QBER is given by 



E m Q m » e Q, a , b - (e - e d ) 



2x 2 y 3 x 2 y 3 N 



N 



+ 



2tt 2 



.4 



m,N 



(B24) 
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3. Randomized but equal overall phase 



Assume Alice and Bob can somehow manage to meet = 0. Then, using Eq. (lB9p . the 
gain is given by 

Q» a » b =y 2 (e-* + e*-2y) 2 , (B25) 
and, from Eq. (1B14|) . the corresponding QBER is given by 



E, a , b Q, an = e Q, a , b - (e - e d )y 2 (e x - e"*) 2 . (B26) 

One can evaluate the key rate using Eq. flU]) by taking the lower bound of Q' ^ b = 0. We 
numerically verified that the key rate obtained from Eqs. (1B25|) and (1B26j) is close to that 



of the original MDI-QKD scheme in [20] for the parameter set given in Table HI 
4. The original MDI-QKD scheme 

In our path-phase encoding scheme of Fig. [H the four BB84 states are encoded by the 
relative phases of two orthogonal optical modes, r and s. If we think of single-photon states 
in r and s modes as a standard basis for qubit representation, our encoding uses the basis 
vectors of X and Y Pauli operators. In our setup, one can also encode key information 
directly onto modes r and s as the third basis (Z basis) for QKD. In fact, the rectilinear 
basis in the original MDI-QKD can be regarded as using this third basis. The diagonal basis 
in [2^] is then equivalent to the X basis in our scheme. 

Using the above correspondence, we reproduce the key rate formula for the original MDI- 



QKD scheme in 



which is given by 
R > Q n [l ~ H(e n )) - Q Icc tf(E vcct )H(E vcct ), (B27) 



where Qu and en are, respectively, given by Eqs. fIBip and flAlip . and Q Tec t and E rect are, 
respectively, the gain and the QBER in the rectilinear basis. The latter two are the only 
terms that we need to calculate here, as described below. Note that Qn is the same for 
both rectilinear and diagonal bases. 

In the rectilinear basis, Alice chooses one of the two r and s modes and sends a phase- 
randomized coherent state | e l ^ a y/JT^) ■ Similarly, Bob sends \e l ^ b y/jlb) in one of the two 
modes. If different modes are chosen by Alice and Bob, then a click on one of the r detectors, 
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in Fig. [H as well as a click on one of the s detectors, correctly indicate the exchange of 
anticorrelated bits by Alice and Bob. If, however, they choose similar modes, and such a 
two-click event occurs, they mistakenly assign different bits to their raw keys, and that will 
be a source of error. The overall gain in the rectilinear basis is then given by the sum of 
detection probabilities in the above scenarios as follows: 

Qrcct = Qrcct Qrect; (B28) 

where 

Ql2 = 2(1 - p d ) 2 e-»'/ 2 [I - (1 - p d )e-^' 2 ] [1 - (1 - p d )e-^ 2 ] (B29) 
represents the detection probability in the first scenario, and 

OS = 2pd(l - P d ) 2 e-»' /2 lh{2x) - (1 - p d )e^'' 2 ] (B30) 

represents the detection probability in the second scenario, where y! and x are defined in 
Eq. flB7p . Note that the above equation also includes averaging over the randomized overall 
phase. 

Finally, considering misalignment errors, we obtain 

-ErectQrect = e d Q^ t + (1 — e d )Q^ t . (B31) 
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